SAN FRANCISCO, 11 AUG 2026 — Five companies that compete directly with one another have agreed on a folder layout. Agent Plugins 1.0.0, released on 6 August, defines how an AI agent's skills and tool connections are packaged so that the same bundle works in someone else's product.

The technical steering committee is AWS, Cursor, Microsoft, OpenAI and Vercel. Vercel wrote the initial draft. Google announced participation on the day of release.

What the specification actually is

Very little, deliberately. A plugin is a directory containing a JSON manifest that declares the plugin's identity and entry points, with fixed locations for its parts: a skills/ folder for Agent Skills, and an MCP configuration for connections to external tools and data.

That is the whole of version 1.0.0. AWS is explicit about what is excluded: "How clients install, surface, or distribute plugins is intentionally outside the spec." Hooks, sub-agents and other extension types are named as future work.

Agent SkillsReusable instructions and resources. Created by Anthropic in 2025.
MCP serversConnections to external tools and data.
The pluginA directory with a manifest that packages both into one distributable unit.
Not in scopeInstallation, distribution, policy, user experience, client-specific behaviour.

Why a small specification is the interesting part

The instinct with a standards effort is to ask what it covers. Here the revealing question is what it leaves alone.

Everything left out is a place where these five companies compete. How plugins are discovered, how they are installed, what a marketplace looks like, what the client is allowed to run without asking — those are product decisions, and a standard that fixed them would be a standard nobody signs.

What is standardised is the boring part: where the files sit. That is precisely the layer at which portability is achievable and nobody's advantage is threatened, which is why an agreement exists at all.

What it fixes for anyone building on agents

Until now, an organisation that invested in agent capability was investing in one vendor's format. Instructions written for one client's skills mechanism did not move; tool connections were configured per product.

That is a real cost and an under-discussed one, because it is not paid at purchase. It is paid the first time you want to change client, or run two, or hand a capability to a team that standardised on something else. The work is not intellectually hard. It is just re-done, repeatedly, by people who have better things to do.

A shared directory format converts that from a rewrite into a copy. Compatible clients on the announced list include VS Code, Cursor, GitHub Copilot, ChatGPT, Codex and Amazon's Kiro.

The layering underneath is the durable design

Agent Plugins does not replace anything. It composes two existing pieces.

MCP handles connectivity to databases, APIs, or file stores. Agent Skills provide the instructions: what to do, in what order, with what conventions. They answer different questions, and until now they were distributed separately even though a useful capability almost always needs both.

The plugin is simply the envelope that says "these belong together". That is a modest idea and a correct one, and it is the reason the spec can be small: the hard interfaces were already defined and adopted elsewhere.

The name not on the committee

Agent Skills, one of the two things being standardised here, was created by Anthropic. Anthropic is not among the five companies on the technical steering committee in either account we read.

We could not establish why, and it would be wrong to read much into it — a company can have its format adopted as a de facto standard without wanting to co-chair the committee that formalises it, and open formats becoming common property is what open formats are for. We say so plainly because a standard built on someone's format without them in the room is an unusual arrangement, and governance is where that would show.

Governance is currently the five founding companies, with the contribution process and technical decisions described as fully public. One account also places the effort alongside the Agentic AI Foundation under the Linux Foundation; the AWS post names no foundation.

What to watch

Whether the excluded parts stay excluded. The pressure on any successful format is to grow, and the first proposed extension into distribution or policy will be the real test of this agreement.

Whether a plugin written for one client runs unmodified in another. "Write once, run everywhere" has a poor historical record, and the honest test is somebody moving a non-trivial capability between two of the listed clients and reporting what broke.

And whether hooks arrive. They are on the roadmap, they are the mechanism by which a plugin executes code at defined points, and they are a much larger security question than a folder of instructions.